Dumping Android Memory

Fridump

https://github.com/Nightbringer21/fridump

This is a python Frida script for dumping accessible memory addresses

python fridump.py -U myApp

This will dump all of the memory regions associated with the app as binary files. Run strings against these files

python fidump.py -o AppName -s -u 'App Name'

The above command will run strings command and output a file called strings.txt

ADB

The following command will dump the heap of a process to a file:

adb shell am dumpheap <PID> <file path>

You would then pull the hprof file from the device and analyze it:

adb pull /data/local/tmp/dump.hprof

Objection

Objection cal also be used to dump memory. The script used by objection is based on the fridump script

memory dump from_base <base_address> <size_to_dump> <local_destination>